@bongos/core 1.19.183 → 1.19.185

package/src/bongos/db.js

@@ -338,10 +338,10 @@ function singleRungPromotionError(oldRank, newRank) {
 // has nothing to collide on, so it's returned unchanged. Pure + exported so
 // tests can exercise it without a DB; claimTask calls it inside the txn.
 
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
-// (BV1.R95b, ADR 0151). Resolved through the `governance.roleSync` kernel port and
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
+// (BV1.R95b, ADR 0151). Resolved through the `government.rankSync` kernel port and
 // run on the CALLER's transaction client, so the role rotation is atomic with the
-// rank write beside it. Core never requires modules/governance/ (ADR 0083).
+// rank write beside it. Core never requires modules/government/ (ADR 0083).
 //
 // A missing port means the governance module is disabled, and skipping is the
 // fail-closed answer: the builder then holds no role and resolves to ZERO
@@ -351,9 +351,9 @@ function singleRungPromotionError(oldRank, newRank) {
 // TWINNED with modules/lifecycle/db.js (the boundary-forced _applyRankChangeTx
 // duplication, ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 async function _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, reasonNote = null, enforceSingleRungPromotion = false }) {

package/src/bongos/module-scope-map.js

@@ -174,30 +174,15 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
-  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
-  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
-  //     so the wall is identical whichever key a goal names and whichever name
-  //     the folder currently has on disk. The `government` key must land BEFORE
-  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
-  //     folder first would leave goal 1000068's own wall not matching the files
-  //     its remaining tasks need to touch, blocking the rename mid-goal.
-  //     `modules/government/` is registered in protected-surfaces.json in the
-  //     same change — `protected` DERIVES from that registry, so without it this
-  //     key would compute protected:false and silently drop the Archon gate.
+  //     RENAMED governance → government (goal 1000068, ADR 0174). The
+  //     transitional `governance` alias key was removed in R05 (task 1003006)
+  //     together with the /governance/* route aliases — the same compatibility
+  //     window. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in the same change, so
+  //     no stored row references a key the map no longer defines.
   government: [
-    'modules/government/', 'modules/governance/',
+    'modules/government/',
     'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
-  ],
-  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
-  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
-  //     (task 1003006), the release that drops the /governance/* route aliases;
-  //     the two removals are the same compatibility window and should land
-  //     together.
-  governance: [
-    'modules/government/', 'modules/governance/',
-    'config/government.json', 'config/government.neutral.json',
-    'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---
   // BV1.R85: hall-UI graduated to modules/hall-ui/ — public-builders/ moved to

package/src/bongos/permission-path-check.js

@@ -40,7 +40,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // GOVERNANCE OWNS THE DATA; THE SUBSTRATE STAYS THE ENFORCER. Which paths are
 // protected, at what rank floor, mapped to which `system: true` catalog
 // permission, is governance-owned data in
-// modules/governance/protected-surfaces.json — no longer a constant baked into
+// modules/government/protected-surfaces.json — no longer a constant baked into
 // this file. Re-mapping a floor there is a POLICY edit. It cannot move
 // enforcement into the app: the three layers above (git pre-push hook, grader
 // pre-pass, post-push main audit) plus gate-review.js and the goal-scope check
@@ -61,7 +61,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // file that ships inside the core package next to this file (modules/ ships with
 // @bongos/core, ADR 0108 §1). The sibling trust primitive route-rank-check.js
 // already reads modules/*/routes/*.js off disk the same way, to rank-gate them.
-// Code still flows ONE way only: modules/governance/protected-surfaces.js →
+// Code still flows ONE way only: modules/government/protected-surfaces.js →
 // src/module-api.js → this matcher. Nothing in core requires the module.
 //
 // FAIL-CLOSED: a missing/empty/malformed registry THROWS. It never degrades to
@@ -71,7 +71,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // Resolved from __dirname (this file is <coreRoot>/src/bongos/) rather than via
 // instance-config so the load keeps zero repo imports and works in a bare git
 // hook.
-const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'protected-surfaces.json');
+const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'protected-surfaces.json');
 
 function loadRegistry(file) {
   let raw;

package/src/bongos/route-rank-check.js

@@ -52,7 +52,7 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // classified 'any-builder': a downgrade that reads as legitimate. To classify it
 // honestly the auditor needs each atom's rank FLOOR (the rank that holds it under
 // governance's compat seed), which is declared exactly once — in
-// modules/governance/catalog.js. There is deliberately NO second permission→rank table
+// modules/government/catalog.js. There is deliberately NO second permission→rank table
 // here; a second list is a list that drifts.
 //
 // READ AS DATA, NOT require()d. ADR 0083's one-way rule forbids core from importing a
@@ -60,14 +60,14 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // core, so we parse the catalog's `floor:` declarations out of its SOURCE — the same
 // technique this file already applies to modules/*/routes/*.js, and the posture the
 // sibling trust primitive permission-path-check.js takes with
-// modules/governance/protected-surfaces.json. Like those, it runs with no DB, no
+// modules/government/protected-surfaces.json. Like those, it runs with no DB, no
 // server and no module loader, so it works inside a git hook.
 //
 // LAZY + FAIL-CLOSED. Loaded on first use, so an instance whose routes carry no
 // permission gate and no permission pin never reads it. An unreadable or empty catalog
 // THROWS rather than degrading to "every atom is unknown"; an atom the catalog does not
 // define classifies 'unknown', which hard-fails a write route.
-const CATALOG_PATH = path.join(MODULES_DIR, 'governance', 'catalog.js');
+const CATALOG_PATH = path.join(MODULES_DIR, 'government', 'catalog.js');
 // low → high authority. Mirrors catalog.js RANK_ORDER; the parse below rejects any
 // floor outside it, so a divergence surfaces as 'unknown' (loud) rather than as trust.
 const PERMISSION_RANK_ORDER = ['xenos', 'thetes', 'metic', 'archon'];
@@ -231,19 +231,18 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
-// The authz-core route pins, referenced by BOTH the `governance` and the
-// `government` module keys below while goal 1000068's rename is in flight
-// (ADR 0174, task 1003003). One object, two keys — never two literals.
+// The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
+// governance→government in R05 (task 1003006); the module-key alias is gone.
 const GOVERNMENT_PINS = {
-  'GET /governance/roles': 'perm:governance.manage',
-  'GET /governance/permissions': 'perm:governance.manage',
-  'GET /governance/assignments': 'perm:governance.manage',
-  'POST /governance/roles': 'perm:governance.manage',
-  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-  'POST /governance/assignments': 'perm:governance.manage',
-  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+  'GET /government/ranks': 'perm:government.manage',
+  'GET /government/permissions': 'perm:government.manage',
+  'GET /government/assignments': 'perm:government.manage',
+  'POST /government/ranks': 'perm:government.manage',
+  'PUT /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'DELETE /government/ranks/:rankKey/permissions/:permissionKey': 'perm:government.manage',
+  'POST /government/ranks/:rankKey/reset': 'perm:government.manage',
+  'POST /government/assignments': 'perm:government.manage',
+  'DELETE /government/assignments/:builderId/:rankKey': 'perm:government.manage',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
@@ -417,17 +416,12 @@ const MODULE_EXPECTED_RANKS = {
   },
   // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
   // the routes that EDIT the rank/permission graph itself. Every route, the three
-  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // reads included, is pinned to the `government.manage` ATOM rather than a rank:
   // on this surface the atom IS the authority (it is the catalog's meta-escalation
   // key), and a downgrade here is the model's worst case — the routes that write
   // authority drifting below the wall that guards authority. Reads are pinned too
   // because the full rank/grant/assignment map is the authority model's blueprint.
   //
-  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
-  // 1003006), not here: R02 only makes the pins reachable under both module keys.
-  // Renaming the paths before the routes move would pin routes that do not exist
-  // and red the build for the whole window.
-  governance: GOVERNMENT_PINS,
   // The same pins under the post-ADR-0174 module name (goal 1000068, task
   // 1003003). Pins are applied only when the module directory is IN SCOPE — at
   // least one route file was discovered under modules/<key>/ — so this entry is

package/src/bongos/serve-internal.js

@@ -749,7 +749,7 @@ function mountInternalSurfaces(app) {
   });
 
   // The /watch monitoring page and the /harbor dev-box management page (idea 257)
-  // and the /gate page (task 1179) all sit behind `page.view.governance` — Metic
+  // and the /gate page (task 1179) all sit behind `page.view.government` — Metic
   // and up since ADR 0157. Same server-side page gate, same posture: a builder
   // without the permission never receives the shell (requireGovernancePage — named
   // requireArchonPage before ADR 0157 — redirects them to the hall, and an
@@ -767,7 +767,7 @@ function mountInternalSurfaces(app) {
   // group without a wall. Gated here so the group is uniform (task 1002710).
   const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
   // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
-  // the `governance.manage` atom itself (archon), the same key its data routes
+  // the `government.manage` atom itself (archon), the same key its data routes
   // check — requireGovernanceManagePage, not the metic-floored gate above.
   const GOVERNANCE_PAGE_RE = /^\/builders\/governance(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the

package/src/module-api.js

@@ -336,7 +336,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         and 2026-08-03 with no bump behind them, so no vendored-tarball instance
 //         could take any of them. Headline: the governance permission system
 //         (BV1.R95–R109 — resolver + kernel port, first-class principals, session
-//         scopes, requirePermission(), ownership-scoped grants, config/governance.json)
+//         scopes, requirePermission(), ownership-scoped grants, config/government.json)
 //         and the route-rank/validation hardening that followed it; the ship.js
 //         Windows project-path fix so Windows sessions actually get paid (89f291c);
 //         the sequential chain runner (task 1002484); Metic task abandon/un-abandon
@@ -390,7 +390,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         ad7a262 and never packaged, so ~104 non-merge commits sat on main
 //         reachable by no pin; this is the artifact that ships them. Headline:
 //         the governance permission system's second half (R110 roles/perms/
-//         assignments CRUD behind governance.manage, R113 the Roles nav +
+//         assignments CRUD behind government.manage, R113 the Roles nav +
 //         page gate, R114 the C6 live proof, ADR 0157 delegating the
 //         operational block from Archon to Metic, and the permission resolve
 //         folded into the session load); the scan-before-install security
@@ -793,8 +793,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
 //   1.19.183 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
+//   1.19.184 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
+//   1.19.185 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.184 with no explicit bump. run 31976564067. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.183'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.185'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -34,9 +34,9 @@ const auth = require('../src/bongos/auth.js');
 // exactly as tests/governance_require_permission.mjs stubs it for requirePermission.
 // The audience is unchanged; tests/governance_page_gates.mjs is the parity proof.
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 seams._reset();
-seams.registerProvider('governance', {
+seams.registerProvider('government', {
   resolveBuilderPermissions: async () => catalog.seedForRank('xenos'),
 });
 

package/tests/criterion_authoring_gate.mjs

@@ -29,7 +29,7 @@ const buildDoneWhenRouter = require('../modules/lifecycle/routes/done-when.js');
 const { authorizeCriterionCreate } = buildDoneWhenRouter;
 const { authorizeGoalManagement, isGoalOwnerOrManager } = require('../modules/lifecycle/goal-authz.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 
 const doneWhenSrc = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
 const { test, summary } = makeRunner();

package/tests/governance_abuse_matrix.mjs

@@ -16,7 +16,7 @@
 //     V3  HTTP: assign a seeded rank-role to a builder (rank is the only writer)
 //     V4  HTTP: mass-assignment on role create (is_system / permissions in body)
 //     V5  HTTP: every write vector 403s outright for a caller without
-//         governance.manage (the low-trust builder's own attempt)
+//         government.manage (the low-trust builder's own attempt)
 //     V6  config: a role template proposing system keys is stripped; a seeded
 //         role's template grants are dropped wholesale; env overrides labels only
 //     V7  session-scope: an allow-list naming a system or principal key THROWS
@@ -49,11 +49,11 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const govConfig = require(path.join(ROOT, 'modules', 'governance', 'config.js'));
-const sessionScopes = require(path.join(ROOT, 'modules', 'governance', 'session-scopes.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
-const govDb = require(path.join(ROOT, 'modules', 'governance', 'db.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const govConfig = require(path.join(ROOT, 'modules', 'government', 'config.js'));
+const sessionScopes = require(path.join(ROOT, 'modules', 'government', 'session-scopes.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
+const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
@@ -109,9 +109,9 @@ test('every system permission floors at archon or is a principal (never seeded l
 const calls = [];
 const stub = {
   getRoleByKey: async (k) => (SEEDED_ROLES.includes(k)
-    ? { role_key: k, label: k, is_system: true, seeded_rank: k }
-    : { role_key: k, label: k, is_system: false, seeded_rank: null }),
-  createRole: async (a) => ({ role_key: a.roleKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
+    ? { rank_key: k, label: k, is_system: true, seeded_rank: k }
+    : { rank_key: k, label: k, is_system: false, seeded_rank: null }),
+  createRole: async (a) => ({ rank_key: a.rankKey, label: a.label, description: a.description ?? null, is_system: false, seeded_rank: null, created_by: a.createdBy, created_at: 't' }),
   grantRolePermission: async () => true,
   revokeRolePermission: async () => true,
   resetRoleGrants: async ({ permissionKeys }) => permissionKeys.length,
@@ -127,18 +127,18 @@ for (const k of Object.keys(stub)) {
 }
 
 // The attacker holds the MOST privileged legitimate session — an Archon with
-// governance.manage. The matrix must hold even against the admin misusing the
+// government.manage. The matrix must hold even against the admin misusing the
 // API, not just against a low-trust caller (V5 covers that one).
 const realRequireBuilder = api.requireBuilder;
 api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon' }; next(); };
 
 function grant(keys) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => keys });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
-grant(['governance.manage']);
+grant(['government.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);
@@ -168,7 +168,7 @@ async function call(method, p, body) {
 
 test('V1: EVERY system permission is refused onto a custom role, before the db', async () => {
   for (const k of SYSTEM_KEYS) {
-    const r = await call('PUT', `/governance/roles/custom-role/permissions/${k}`);
+    const r = await call('PUT', `/government/ranks/custom-role/permissions/${k}`);
     assert.equal(r.status, 400, `${k} must be refused`);
     assert.equal(r.json.error.code, 'permission_not_grantable', k);
     assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -185,15 +185,15 @@ test('V1: EVERY system permission is refused onto a custom role, before the db',
 test('V2a: the ARCHON rank-role refuses EVERY write — grant, revoke and reset alike', async () => {
   for (const k of [...SYSTEM_KEYS, 'idea.triage']) {
     for (const method of ['PUT', 'DELETE']) {
-      const r = await call(method, `/governance/roles/archon/permissions/${k}`);
+      const r = await call(method, `/government/ranks/archon/permissions/${k}`);
       assert.equal(r.status, 403, `archon ← ${method} ${k} must be refused`);
-      assert.equal(r.json.error.code, 'archon_role_immutable', `archon ← ${method} ${k}`);
+      assert.equal(r.json.error.code, 'archon_rank_immutable', `archon ← ${method} ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission' || c === 'revokeRolePermission').length, 0);
     }
   }
-  const r = await call('POST', '/governance/roles/archon/reset');
+  const r = await call('POST', '/government/ranks/archon/reset');
   assert.equal(r.status, 403, 'reset must not be a back door into the archon role');
-  assert.equal(r.json.error.code, 'archon_role_immutable');
+  assert.equal(r.json.error.code, 'archon_rank_immutable');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
@@ -201,7 +201,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
   const neverGrantable = [...SUBSTRATE_KEYS, ...catalog.principalKeys()];
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of neverGrantable) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 400, `${role} ← ${k} must be refused`);
       assert.equal(r.json.error.code, 'permission_not_grantable', `${role} ← ${k}`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 0,
@@ -213,7 +213,7 @@ test('V2b: EVERY editable rank-role still refuses every SUBSTRATE and PRINCIPAL
 test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 lever)', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
     for (const k of [...OWNER_POWERS, 'idea.triage']) {
-      const r = await call('PUT', `/governance/roles/${role}/permissions/${k}`);
+      const r = await call('PUT', `/government/ranks/${role}/permissions/${k}`);
       assert.equal(r.status, 200, `${role} ← ${k} must be ACCEPTED — this delegation is the owner's decision (ADR 0172)`);
       assert.equal(calls.filter(([c]) => c === 'grantRolePermission').length, 1, `${role} ← ${k} must reach the db`);
     }
@@ -222,7 +222,7 @@ test('V2c: an editable rank-role ACCEPTS the in-app owner powers (the ADR 0172 l
 
 test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   for (const role of EDITABLE_RANK_ROLES) {
-    const r = await call('POST', `/governance/roles/${role}/reset`);
+    const r = await call('POST', `/government/ranks/${role}/reset`);
     assert.equal(r.status, 200, `${role} must be resettable`);
     const [, args] = calls.find(([c]) => c === 'resetRoleGrants');
     assert.deepEqual([...args.permissionKeys].sort(), [...catalog.seedForRank(role)].sort(),
@@ -233,24 +233,24 @@ test('V2d: reset restores the CATALOG seed, never anything wider', async () => {
   }
   // A custom role has no catalog default, so reset is refused rather than silently
   // clearing its grants (which would be a destructive verb wearing a restore's name).
-  const r = await call('POST', '/governance/roles/custom-role/reset');
+  const r = await call('POST', '/government/ranks/custom-role/reset');
   assert.equal(r.status, 400);
-  assert.equal(r.json.error.code, 'role_has_no_default');
+  assert.equal(r.json.error.code, 'rank_has_no_default');
   assert.equal(calls.filter(([c]) => c === 'resetRoleGrants').length, 0);
 });
 
 test('V3: EVERY seeded rank-role refuses assignment (rank is the only writer — R95b)', async () => {
   for (const role of SEEDED_ROLES) {
-    const r = await call('POST', '/governance/assignments', { builder_id: 7, role_key: role });
+    const r = await call('POST', '/government/assignments', { builder_id: 7, rank_key: role });
     assert.equal(r.status, 403, `assigning seeded role ${role} must be refused`);
-    assert.equal(r.json.error.code, 'seeded_role_assignment_forbidden', role);
+    assert.equal(r.json.error.code, 'seeded_rank_assignment_forbidden', role);
     assert.equal(calls.filter(([c]) => c === 'assignRole').length, 0);
   }
 });
 
 test('V4: mass-assignment on role create is refused outright (strict schema)', async () => {
-  const r = await call('POST', '/governance/roles', {
-    role_key: 'sneaky-role',
+  const r = await call('POST', '/government/ranks', {
+    rank_key: 'sneaky-role',
     label: 'Sneaky',
     is_system: true,
     seeded_rank: 'archon',
@@ -262,32 +262,32 @@ test('V4: mass-assignment on role create is refused outright (strict schema)', a
 });
 
 test('V4: a clean role create is never system and carries no grants', async () => {
-  const r = await call('POST', '/governance/roles', { role_key: 'sneaky-role', label: 'Sneaky' });
+  const r = await call('POST', '/government/ranks', { rank_key: 'sneaky-role', label: 'Sneaky' });
   assert.equal(r.status, 201);
   assert.equal(r.json.role.is_system, false, 'a created role is never system');
   assert.equal(r.json.role.seeded_rank, null);
   assert.deepEqual(r.json.role.permissions, [], 'creation carries no grants');
   const c = calls.find(([k]) => k === 'createRole');
-  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'roleKey'],
+  assert.deepEqual(Object.keys(c[1]).sort(), ['createdBy', 'description', 'label', 'rankKey'],
     'nothing beyond the four whitelisted fields reaches the db');
   assert.equal(calls.filter(([k]) => k === 'grantRolePermission').length, 0);
 });
 
-test('V5: a caller without governance.manage cannot reach ANY write vector at all', async () => {
-  grant(catalog.grantableKeys().filter((k) => k !== 'governance.manage'));
+test('V5: a caller without government.manage cannot reach ANY write vector at all', async () => {
+  grant(catalog.grantableKeys().filter((k) => k !== 'government.manage'));
   for (const [method, p, body] of [
-    ['POST', '/governance/roles', { role_key: 'x-role', label: 'X' }],
-    ['PUT', '/governance/roles/custom-role/permissions/deploy.push_main', undefined],
-    ['DELETE', '/governance/roles/custom-role/permissions/idea.triage', undefined],
-    ['POST', '/governance/roles/metic/reset', undefined],
-    ['POST', '/governance/assignments', { builder_id: 7, role_key: 'custom-role' }],
-    ['DELETE', '/governance/assignments/7/custom-role', undefined],
+    ['POST', '/government/ranks', { rank_key: 'x-role', label: 'X' }],
+    ['PUT', '/government/ranks/custom-role/permissions/deploy.push_main', undefined],
+    ['DELETE', '/government/ranks/custom-role/permissions/idea.triage', undefined],
+    ['POST', '/government/ranks/metic/reset', undefined],
+    ['POST', '/government/assignments', { builder_id: 7, rank_key: 'custom-role' }],
+    ['DELETE', '/government/assignments/7/custom-role', undefined],
   ]) {
     const r = await call(method, p, body);
     assert.equal(r.status, 403, `${method} ${p} must deny — even holding every operational grant`);
     assert.equal(r.json.error.code, 'permission_forbidden', `${method} ${p}`);
   }
-  grant(['governance.manage']);
+  grant(['government.manage']);
 });
 
 // ===========================================================================

package/tests/governance_catalog.mjs

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const cat = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const cat = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
 
 test('every permission is well-formed (key, boolean system, valid floor)', () => {
@@ -57,7 +57,7 @@ test('substrate keys are the out-of-band three, and each implies system + archon
     assert.equal(byKey(k).floor, 'archon', `${k} must floor at archon`);
     assert.equal(byKey(k).principal, null, `${k} must not also be a principal key`);
   }
-  assert.equal(cat.isSubstrate('governance.manage'), false, 'an in-app archon power is not substrate');
+  assert.equal(cat.isSubstrate('government.manage'), false, 'an in-app archon power is not substrate');
   assert.equal(cat.isSubstrate('nope.not.a.key'), false, 'unknown fails closed');
 });
 
@@ -67,7 +67,7 @@ test('isGrantableTo: a sub-Archon rank-role takes owner powers, a custom role do
   const custom = { is_system: false, seeded_rank: null };
 
   // The widening: an in-app archon power reaches a rank-role, never a custom one.
-  for (const k of ['governance.manage', 'builder.rank.set', 'version.close']) {
+  for (const k of ['government.manage', 'builder.rank.set', 'version.close']) {
     assert.equal(cat.isGrantableTo(k, metic), true, `${k} → metic rank-role`);
     assert.equal(cat.isGrantableTo(k, custom), false, `${k} → custom role must stay refused`);
   }
@@ -173,7 +173,7 @@ test('an unknown/reserved rank resolves to no permissions (fail-closed; ADR 0151
 });
 
 test('byKey returns a frozen record or null', () => {
-  const p = byKey('governance.manage');
+  const p = byKey('government.manage');
   assert.ok(p && p.system === true && p.floor === 'archon');
   assert.throws(() => { p.system = false; }, /Cannot assign|read only|frozen/i);
   assert.equal(byKey('nope'), null);

package/tests/governance_claim_eligibility.mjs

@@ -36,7 +36,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 

package/tests/governance_config.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
@@ -157,7 +157,7 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   // the CI gate (which does not scan .json itself — IDENTITY_SCAN_EXTS is js/html/css).
   const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
-  assert.deepEqual(scanPromptIdentity('config/governance.neutral.json', raw, '.json'), []);
+  assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
   // And it carries only templates — never a live per-builder assignment.
   assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['roles']);
   for (const role of Object.values(NEUTRAL.roles)) {
@@ -166,13 +166,13 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
 });
 
 test('the two config paths are the branding-shaped neutral/instance pair under config/', () => {
-  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/governance.neutral.json');
-  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/governance.json');
+  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/government.neutral.json');
+  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/government.json');
   assert.ok(fs.existsSync(NEUTRAL_PATH), 'the neutral starter must ship — it is the vanilla default');
 });
 
 test('loadGovernanceConfig reads the real neutral starter and tolerates a missing instance pack', () => {
-  // A vanilla instance has no config/governance.json at all — the default INSTANCE_PATH
+  // A vanilla instance has no config/government.json at all — the default INSTANCE_PATH
   // is genuinely absent in this checkout, so the default call exercises that path.
   assert.equal(fs.existsSync(INSTANCE_PATH), false, 'fixture guard: this checkout is the vanilla case');
   const out = loadGovernanceConfig({ env: NO_ENV });
@@ -182,6 +182,6 @@ test('loadGovernanceConfig reads the real neutral starter and tolerates a missin
 
 test('the neutral starter publishes with the core (a packaged vanilla instance needs it)', () => {
   const { isPublishable } = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
-  assert.equal(isPublishable('config/governance.neutral.json'), true);
-  assert.equal(isPublishable('config/governance.json'), false, "a host's filled-in pack is instance content");
+  assert.equal(isPublishable('config/government.neutral.json'), true);
+  assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });

package/tests/governance_fold.mjs

@@ -27,7 +27,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
 function fakeRes() {
@@ -44,7 +44,7 @@ function fakeRes() {
 // One gate run against a stubbed port. `port` null = unregistered.
 async function run(req, port) {
   seams._reset();
-  if (port !== null) seams.registerProvider('governance', port);
+  if (port !== null) seams.registerProvider('government', port);
   const res = fakeRes();
   let nexted = false;
   await auth.requirePermission('idea.triage')(req, res, () => { nexted = true; });
@@ -121,7 +121,7 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
@@ -133,7 +133,7 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'));
   buildGovernanceRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');

package/tests/governance_fold_bench.mjs

@@ -1,7 +1,7 @@
 // tests/governance_fold_bench.mjs — the task-1002556 benchmark, re-runnable.
 //
 // Measures end-to-end latency of a requireBuilder + requirePermission route
-// (GET /governance/roles) against a LIVE server, the way the fold was graded:
+// (GET /government/ranks) against a LIVE server, the way the fold was graded:
 // point it at a stack before and after and compare. Asserts only route health
 // (every request 200) — the numbers are the deliverable, printed for the
 // operator to diff.
@@ -27,7 +27,7 @@ import { strict as assert } from 'node:assert';
 const BASE = (process.env.GDS_BASE_URL || '').replace(/\/$/, '');
 const TOKEN = process.env.BENCH_TOKEN || '';
 if (!BASE || !TOKEN) {
-  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds governance.manage).');
+  console.log('governance_fold_bench.mjs SKIPPED — set GDS_BASE_URL and BENCH_TOKEN (a session token whose builder holds government.manage).');
   process.exit(0);
 }
 const N = Number(process.env.BENCH_N) || 300;